Venus Prime - turvy_fuzz's results

Lines of code

https://github.com/code-423n4/2023-09-venus/blob/main/contracts/Tokens/Prime/Prime.sol#L221

Vulnerability details

Impact

Update score breaks and reverts due to underflow caused by pendingScoreUpdates variable.

Proof of Concept

updateScores():

function updateScores(address[] memory users) external {
        if (pendingScoreUpdates == 0) revert NoScoreUpdatesRequired();
        if (nextScoreUpdateRoundId == 0) revert NoScoreUpdatesRequired();

        for (uint256 i = 0; i < users.length; ) {
            address user = users[i];

            if (!tokens[user].exists) revert UserHasNoPrimeToken();
            if (isScoreUpdated[nextScoreUpdateRoundId][user]) continue;

            address[] storage _allMarkets = allMarkets;
            for (uint256 j = 0; j < _allMarkets.length; ) {
                address market = _allMarkets[j];
                _executeBoost(user, market);
                _updateScore(user, market);

                unchecked {
                    j++;
                }
            }

            pendingScoreUpdates--;
            isScoreUpdated[nextScoreUpdateRoundId][user] = true;

            unchecked {
                i++;
            }

            emit UserScoreUpdated(user);
        }
    }

In each iteration, pendingScoreUpdates is decremented:

            pendingScoreUpdates--;

This assumes pendingScoreUpdates is always >= length of users that has PrimeToken else it would always underflow, however this is not true, as it only directly updated in few places e.g in _burn() but not updated when new users are issued prime tokens. Which means pendingScoreUpdates could be lesser when possible number of users that PrimeToken exists for increases.

Tools Used

Manaul Review

Recommended Mitigation Steps

Reconsider the pendingScoreUpdates interactions. I suggest direactly updating pendingScoreUpdates in calling issue() and maybe also check if the passed users array length matches the pendingScoreUpdates on the updateScores() function

Assessed type

Under/Overflow